CVE-2024-25128: Flask-AppBuilder Auth Bypass Vulnerability

CVE-2024-25128 Overview

CVE-2024-25128 is an authentication bypass vulnerability in Flask-AppBuilder, a popular application development framework built on top of Flask. When Flask-AppBuilder is configured to use AUTH_TYPE AUTH_OID (OpenID authentication), the application fails to properly validate the OpenID service provider, allowing attackers to forge HTTP requests that deceive the backend into using any requested OpenID service.

This vulnerability could grant an attacker unauthorized privilege access if a custom malicious OpenID service is deployed by the attacker and accessible by the backend. The vulnerability is specifically exploitable when the application uses the OpenID 2.0 authorization protocol.

Critical Impact

Attackers can forge OpenID authentication requests to gain unauthorized privileged access by deploying a malicious OpenID service that the vulnerable backend will trust.

Affected Products

• dpgaspar Flask-AppBuilder (versions prior to 4.3.11)

Discovery Timeline

• 2024-02-29 - CVE-2024-25128 published to NVD
• 2025-10-14 - Last updated in NVD database

Technical Details for CVE-2024-25128

Vulnerability Analysis

This vulnerability falls under CWE-287 (Improper Authentication), indicating a fundamental flaw in the authentication mechanism. The core issue lies in the lack of validation when processing OpenID provider URLs during the authentication flow. When an application is configured with AUTH_TYPE AUTH_OID, the backend accepts and processes OpenID authentication requests without adequately verifying the legitimacy of the OpenID service provider.

The attack is network-accessible and requires no prior authentication or user interaction, making it particularly dangerous for internet-facing applications. However, the vulnerability only affects the confidentiality and integrity of the system without direct impact on availability.

Root Cause

The root cause stems from insufficient validation of the OpenID service URL during the authentication process. Flask-AppBuilder's OpenID integration accepts provider URLs from client-controlled input without verifying they belong to a trusted list of OpenID providers. This trust assumption allows attackers to redirect authentication flows to malicious OpenID services under their control.

The vulnerable code path processes the OpenID discovery and authentication without implementing proper provider allowlisting or URL validation, enabling the backend to communicate with arbitrary OpenID endpoints specified by the attacker.

Attack Vector

The attack vector is network-based and follows this general exploitation pattern:

1. The attacker identifies a Flask-AppBuilder application using AUTH_OID authentication
2. The attacker sets up a malicious OpenID service that they control
3. The attacker crafts a forged HTTP request directing the backend to authenticate against their malicious OpenID service
4. The backend, lacking proper validation, communicates with the attacker's OpenID service
5. The malicious OpenID service responds with fabricated authentication assertions
6. The backend trusts these assertions, granting the attacker unauthorized access with potentially elevated privileges

The vulnerability requires the malicious OpenID service to be network-accessible from the target backend server. Successful exploitation allows attackers to bypass authentication entirely and potentially impersonate any user, including administrators.

Detection Methods for CVE-2024-25128

Indicators of Compromise

• Unexpected outbound connections from the Flask-AppBuilder backend to unknown OpenID service endpoints
• Authentication logs showing successful logins via unusual or unrecognized OpenID providers
• Network traffic to newly registered domains or suspicious IP addresses during OpenID discovery phases
• Anomalous user account access patterns, especially privileged accounts being accessed from unusual sources

Detection Strategies

• Monitor outbound network connections from application servers for connections to unauthorized OpenID endpoints
• Implement application-layer logging to capture all OpenID provider URLs processed during authentication
• Deploy network segmentation rules to restrict which external services the backend can communicate with
• Review authentication logs for logins using OpenID providers not on the organization's approved list

Monitoring Recommendations

• Configure SIEM rules to alert on authentication events involving unknown OpenID providers
• Implement egress filtering and monitor for connections to new or suspicious domains during authentication flows
• Enable detailed logging for all OpenID-related authentication attempts including provider URLs
• Establish baseline behavior for normal OpenID authentication patterns and alert on deviations

How to Mitigate CVE-2024-25128

Immediate Actions Required

• Upgrade Flask-AppBuilder to version 4.3.11 or later immediately
• If upgrading is not immediately possible, consider temporarily switching to a different authentication method (such as database authentication or OAuth)
• Audit all existing user accounts for any signs of unauthorized access or privilege escalation
• Review network logs for any suspicious outbound connections to unknown OpenID services

Patch Information

The vulnerability has been addressed in Flask-AppBuilder version 4.3.11. The fix is available in commit 6336456d83f8f111c842b2b53d1e89627f2502c8. Organizations should upgrade using their standard Python package management process.

For detailed information about the vulnerability and the fix, refer to the GitHub Security Advisory GHSA-j2pw-vp55-fqqj and the patch commit.

Workarounds

• If using OpenID 2.0 authentication, consider migrating to OAuth 2.0 or OIDC (OpenID Connect) which provides stronger security guarantees
• Implement network-level restrictions to limit which external services the backend can communicate with for OpenID discovery
• Deploy a Web Application Firewall (WAF) to inspect and filter authentication-related requests
• Configure strict egress firewall rules to only allow connections to known, trusted OpenID providers

# Upgrade Flask-AppBuilder to the patched version
pip install --upgrade Flask-AppBuilder>=4.3.11

# Verify the installed version
pip show Flask-AppBuilder | grep Version